2026-06-26_1e7a6a3bac4218b2ff392e893fec7d41_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-26_1e7a6a3bac4218b2ff392e893fec7d41_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar
Size 2.9MB
Sample260629-waz2laaz6x
SHA256 1fe4e75f547de12b01ff5912aff59589da6c5cde9d81dd12af07c8cd0012ec0f
MD5 1e7a6a3bac4218b2ff392e893fec7d41
SHA1 1057a75964b94ecffcc4d003cc47f094e249e62c
SHA512 5c3e314e89f6f124261f94f328373d8d410343aab19771a6dc743dcb2e58c45abaeaa6832e3b18e7af56ffe7d50605c2af3e6341c58d09743fa35362dde02b7d
SSDEEP 49152:w0Rg/r2OfFz/Mxwu1AtameZtip1vCfy/Ubsi1fvwlekEBrn2jn5VRT:6MxDdekbvOelSn5VRT
TLSH
T1B8E5F117B69541E4D02EC1B5CB464276E972BC960F34AADF0680B3592E77EE42F3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-26_1e7a6a3bac4218b2ff392e893fec7d41_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar

File Explorer

2026-06-26_1e7a6a3bac4218b2ff392e893fec7d41_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar

.exe 2.9MB

2026-06-26_1e7a6a3bac4218b2ff392e893fec7d41_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar

IMPHASH 0ab7a9a1b89b8e6e674c00f488980350
SHA256 1fe4e75f547de12b01ff5912aff59589da6c5cde9d81dd12af07c8cd0012ec0f
MD5 1e7a6a3bac4218b2ff392e893fec7d41
SHA1 1057a75964b94ecffcc4d003cc47f094e249e62c
SHA512 5c3e314e89f6f124261f94f328373d8d410343aab19771a6dc743dcb2e58c45abaeaa6832e3b18e7af56ffe7d50605c2af3e6341c58d09743fa35362dde02b7d
SSDEEP 49152:w0Rg/r2OfFz/Mxwu1AtameZtip1vCfy/Ubsi1fvwlekEBrn2jn5VRT:6MxDdekbvOelSn5VRT
TLSH
T1B8E5F117B69541E4D02EC1B5CB464276E972BC960F34AADF0680B3592E77EE42F3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

530336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\e\src\out\Release_x64\pwahelper.exe.pdb

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateEventW CreateFileW CreateThread DeleteCriticalSection DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetLocalTime GetLocaleInfoW GetLogicalProcessorInformation GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProductInfo GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetThreadId GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExW InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEnvironmentVariableW SetEvent SetFilePointerEx SetLastError SetStdHandle SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnregisterWaitEx VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrlenA

ole32

CoCreateInstance CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoUninitialize

shell32

CommandLineToArgvW ord680

winmm

timeGetTime

Name

.text

Size

892KB

Virtual Size

892KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

148KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

62KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

92B

Characteristics

Name

.tls

Size

512B

Virtual Size

297B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

68B

Characteristics

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

666KB

Virtual Size

668KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-26_1e7a6a3bac4218b2ff392e893fec7d41_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar

api-ms-win-core-winrt-l1-1-0

kernel32

ole32

shell32

winmm

generic